目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告
12,220
关联 CVE
1,854
参与项目数
342
近 7 天新增
7
严重度: All CriticalHighMediumLow
类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
An attacker can submit a Pentest Opportunity and change the status of the opportunity from submitted to in_review or reviewed
HackerOne Improper Access Control - Generic (CWE-284)
Medium
2024-01-04
[PATs] Ability to leak comments from issues without ANY "Issues" repo permissions by utilizing "Pull Request" permissions
GitHub Improper Access Control - Generic (CWE-284)CVE-2023-51380
Medium
2024-01-03
[PATs] Token with Read-Only permissions on Issues able to modify issue comments using content write permission
GitHub Improper Access Control - Generic (CWE-284)CVE-2023-51379
Medium
2024-01-03
1 Click to 'Close Account and Refund' via POSTMESSAGE
TikTok Improper Access Control - Generic (CWE-284)
Medium
2024-01-03
DNS pin middleware can be tricked into DNS rebinding allowing SSRF
Nextcloud Server-Side Request Forgery (SSRF) (CWE-918)CVE-2023-48306
Medium
2024-01-01
curl cookie mixed case PSL bypass
Internet Bug Bounty Information Exposure Through Sent Data (CWE-201)CVE-2023-46218
Medium
2023-12-22
OpenSSL vulnerable to the Marvin Attack (CVE-2022-4304)
Internet Bug Bounty Information Exposure Through Timing Discrepancy (CWE-208)CVE-2022-4304
Medium
2023-12-21
IDOR to delete profile images in https:███████
U.S. Dept Of Defense Insecure Direct Object Reference (IDOR) (CWE-639)
Medium
2023-12-21
[████████] RXSS via "CurrentFolder" parameter
U.S. Dept Of Defense Cross-site Scripting (XSS) - Reflected (CWE-79)
Medium
2023-12-21
Unauthorized access to Argo dashboard on █████
U.S. Dept Of Defense Improper Access Control - Generic (CWE-284)
Medium
2023-12-21
Elasticsearch is currently open without authentication on https://██████l
U.S. Dept Of Defense Information Disclosure (CWE-200)
Medium
2023-12-21
Self XSS when pasting HTML into Text app with Ctrl+Shift+V
Nextcloud Cross-site Scripting (XSS) - DOM (CWE-79)CVE-2023-48302
Medium
2023-12-21
DoS in bigdecimal's sqrt function due to miscalculation of loop iterations
Ruby Uncontrolled Resource Consumption (CWE-400)
Medium
2023-12-20
Avatar URL is exposed in patron export for secret donations
Liberapay Privacy Violation (CWE-359)
Medium
2023-12-15
Able to blocking users with 2fa from login into their accounts by just knowing the SteamID
CS Money Reliance on Cookies without Validation and Integrity Checking in a Security Decision (CWE-784)
Medium
2023-12-14
URI parser's RFC3986 regular expression has poor performance when there are two # characters, leading to ReDoS
Ruby CVE-2023-28755
Medium
2023-12-13
Misconfiguration in AWS CloudFront CDN configuration makes rubygems.org serve (and cache) content from a unclaimed S3-bucket
Internet Bug Bounty Misconfiguration (CWE-16)
Medium
2023-12-07
CSRF that makes any linkedin user follow attacker controlled accounts by simply clicking https://www.linkedin.com/comm/mynetwork/discovery-see-all/*
LinkedIn Cross-Site Request Forgery (CSRF) (CWE-352)
Medium
2023-12-06
CSRF that makes any user send invitations to the attacker by simply clicking on a link.
LinkedIn Cross-Site Request Forgery (CSRF) (CWE-352)
Medium
2023-12-06
CVE-2023-46218: cookie mixed case PSL bypass
curl Information Exposure Through Sent Data (CWE-201)CVE-2023-46218
Medium
2023-12-06
高频漏洞类型
最活跃项目
项目报告数最高赏金
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258 $1,730
X / xAI250 $2,500
Uber239 $9,895